Privacy Policy

SkillShift+ is a Canadian education, career-readiness and workforce-development platform operated by Intellidu Canada Inc. ("Intellidu", "we", "us" or "our"), a company with its registered office at 1910-135 Hillcrest Avenue, Mississauga, ON L5B 4B1, Canada. SkillShift+ is presented with the attribution "Powered by IntelliDu Education".

This Privacy Policy (the "Policy") explains what personal information we collect when you use SkillShift+, why we collect it, how we use and disclose it, how long we keep it, how we protect it, and the choices and rights available to you. It is written to reflect the requirements of the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA") and its ten fair information principles, together with Ontario and federal laws that apply to our activities.

This Policy applies to all of the following:

• the SkillShift+ website, user accounts and account settings;
• the SkillShift+ course catalogue, including the thirty-five (35) course categories and their approximately twelve to fifteen (12–15) modules per course;
• videos, study materials and downloadable learning resources;
• quizzes, module assessments and AI-supported simulations;
• the Career Readiness Assessment (free tier and paid report);
• personalized Career Readiness Reports;
• the AI Interview Coach, including audio and video practice sessions where enabled;
• the Resume Builder;
• the Skill Passport and its 0–1000 workforce-readiness score;
• the Licensing Navigator;
• Certificates of Completion and digital badges;
• payments, subscriptions, credits and billing;
• the Organization and Administrator Portal, where an organization has been granted access;
• customer support and other communications with us; and
• any mobile application or future version of the platform that links to this Policy.

This Policy does not apply to third-party websites, employers, regulators, educational institutions or services that we link to or that you choose to share your information with. Those organizations have their own privacy practices, and we encourage you to review them.

By creating an account you acknowledge that you have read this Policy. Acknowledgement of this Policy is recorded separately from your acceptance of the Terms of Use and separately from any consent you give to artificial intelligence ("AI") processing, interview recording or marketing communications.

Intellidu Canada Inc. is accountable for the personal information under its control, including information transferred to a Service Provider for processing. We have designated a Privacy Officer who is responsible for our compliance with this Policy and with applicable privacy legislation.

The Privacy Officer is responsible for responding to access, correction and deletion requests, maintaining our privacy documentation, overseeing the vendor register, managing privacy incidents, and reviewing this Policy at least annually.

We collect only the personal information that is reasonably necessary for the purposes identified in section 6. The categories below describe what may be collected; what is actually collected for any individual User depends on which features that User chooses to use. Many categories are optional, and optional fields are identified as such at the point of collection.

4.1 Account and identity information

• name;
• email address;
• telephone number, where provided;
• login credentials, including a password stored in hashed form, and session identifiers;
• social-login identifiers where social login is enabled and used (see section 5);
• age-confirmation information (see section 8).

4.2 Profile, career and eligibility information

• country, province or territory of residence, and city where provided;
• preferred occupation, job title and National Occupational Classification ("NOC") preference;
• education, credentials and qualifications;
• work experience, including employers, duties and durations where you enter them;
• language-test results and other skills information;
• licensing and regulatory interests used by the Licensing Navigator;
• immigration status, only where you voluntarily provide it;
• financial-capacity information, only where you voluntarily provide it for the paid Career Readiness Report;
• résumé content and uploaded documents.

4.3 Learning and assessment information

• course and module enrolment, progress, completion status and course locking or unlocking state;
• quiz answers, scores and attempt history;
• simulation inputs, responses and results;
• Career Readiness Assessment answers;
• Career Reports generated for you;
• Certificates of Completion and digital badges issued to you;
• Skill Passport inputs, evidence sources, points awarded and score history;
• Resume Builder content;
• employer or organization feedback, where an organization has been granted access and provides it.

4.4 AI Interview Coach information

• interview audio recordings, where you consent to audio recording;
• interview video recordings, where video practice is enabled and you consent to video recording;
• transcripts generated from those recordings;
• your typed or spoken answers, question-by-question scoring, AI feedback and improvement recommendations;
• credit balances, session counts and usage history.

4.5 AI interaction information

• prompts and inputs that you submit to AI Features;
• outputs returned to you;
• your ratings, corrections or feedback on AI outputs;
• technical metadata such as feature name, model identifier, timestamp and token or usage counts.

4.6 Payment and subscription information

• subscription plan, status, renewal date and cancellation status;
• purchase records, transaction identifiers, amounts, currency, receipts and invoices;
• refund and chargeback records;
• billing contact information;
• credit balances and expiry dates for one-time and monthly interview credits.

We do not normally store full payment card numbers. Card details are collected and processed by Stripe. See section 11.

4.7 Technical, security and support information

• IP address, browser type, device type, operating system and approximate region derived from IP address;
• authentication events, security logs, rate-limiting events and error logs;
• cookie and similar-technology identifiers, as described in the Cookie Policy;
• Consent Records, including grants, refusals, notice versions and withdrawals;
• support tickets, emails and other communications with us, including attachments you send.

Limiting collection. We do not intentionally collect more personal information than is reasonably necessary for the identified purpose. We ask you not to submit sensitive personal information — including health information, government identification numbers, Social Insurance Numbers or financial account numbers — into free-text fields, résumé uploads, AI prompts or interview answers where it is not required.

We collect personal information from the following sources:

We identify the purposes for which personal information is collected at or before the time of collection. We use personal information for the following purposes:

If we propose to use personal information for a purpose that is not identified in this Policy and that is not permitted or required by law, we will identify that purpose and obtain your consent before doing so.

Several SkillShift+ features rely on AI processing performed through the OpenAI API. This section explains that processing. A shorter, feature-level notice is presented before you first use an AI Feature; see the AI Consent and Transparency Notice.

7.1 Features that use AI

• Career Readiness Reports;
• AI Interview Coach, including question generation, scoring and feedback;
• Resume Builder assistance;
• module simulations;
• career and course recommendations;
• Skill Passport insights and narrative summaries;
• course-support tools such as explanation and practice aids.

7.2 What is sent, and why

We are committed to transmitting only the information reasonably necessary for the relevant feature. Where a feature can operate on a summarized or partial record, we aim to send the summary rather than the full profile.

7.3 Training, retention and provider practices

• SkillShift+ does not use customer personal information to train AI models.
• SkillShift+ will not opt in to any AI provider programme that would permit our customers' inputs or outputs to be used for model training.
• OpenAI states that inputs and outputs submitted through its API are not used to train its models by default unless the customer explicitly opts in. We rely on that default and do not opt in.
• Standard API abuse-monitoring logs may nevertheless be retained by the provider for a limited period — currently stated by OpenAI as up to thirty (30) days — depending on the API feature and account controls in use. We do not represent that no copy of the information exists anywhere outside our systems.
• AI processing may occur on servers located outside Ontario and outside Canada. See section 10.

7.4 Our own retention of AI inputs and outputs

We retain AI inputs and outputs in accordance with the retention schedule in section 13. In summary: interview audio and video are retained for ninety (90) days unless deleted earlier; interview transcripts and AI feedback are retained for twelve (12) months; and Career Reports, Skill Passport data and Resume Builder content are retained for the active period plus up to twenty-four (24) months.

7.5 Limitations of AI output

• AI output may be incomplete, inaccurate, outdated or inconsistent, and may reflect bias present in underlying data.
• AI output is informational and educational. It does not constitute legal, immigration, licensing, financial or employment advice.
• AI does not make final employment, immigration, licensing or admission decisions on the Platform, and no such decision is made about you by automated means without the ability to obtain human review.
• Scores, including AI-influenced components of the Skill Passport, are indicative and are not a determination of employability.
• You should verify important information — including licensing requirements, NOC classification and immigration criteria — with the responsible employer, regulator, institution or government authority before relying on it.

We obtain consent that is meaningful: consent given with a reasonable understanding of what is collected, who it is shared with, why, and what the reasonably foreseeable consequences are. Consent is obtained separately for materially different activities. A single general checkbox covering everything is not used.

8.1 Separate permissions

8.2 What we record

For each permission we record: the user identifier; the consent type; whether it was granted or refused; the version of the notice presented; the date and time; the method of collection; the withdrawal date where applicable; and, where appropriate for security and evidentiary purposes, the device or IP address associated with the action.

8.3 Withdrawing consent

You may withdraw an optional consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal is not retroactive: it does not affect processing already carried out lawfully. Withdrawing AI consent will disable AI Features, and withdrawing recording consent will disable recorded interview practice. Some withdrawals will limit or prevent your use of parts of the Platform, and we will tell you when that is the case before you confirm.

To withdraw consent, use the controls in your account settings where available, or email info@skillsshift.ca.

8.4 Consent exceptions

In limited circumstances permitted by law, we may collect, use or disclose personal information without consent — for example, to investigate a breach of an agreement or a contravention of law, to prevent or detect fraud, where the information is publicly available as defined by regulation, in an emergency threatening life, health or security, or where required by a court order, subpoena, warrant or other lawful demand.

SkillShift+ is not directed at children under 16 and we do not knowingly collect personal information from them. If we become aware that we have collected personal information from a person under 16, we will delete it promptly, subject to any records we are required by law to retain.

At registration we ask you to confirm that you meet the minimum age. We ask for age confirmation rather than collecting a full date of birth where a full date of birth is not required for the feature you are using. If we later require a date of birth for a specific purpose, we will explain that purpose at the point of collection.

If you are a parent or guardian and believe that a person under 16 has created an Account, contact info@skillsshift.ca and we will investigate.

We do not sell personal information. We do not rent or trade personal information. We disclose personal information only as described in this section.

10.1 Service Providers

We engage the following categories of Service Provider to process information on our behalf. Each receives only the information reasonably needed to perform its service, and is required by contract to protect it and to use it only for the purposes we specify.

A detailed internal Vendor and Subprocessor Register is maintained by the Privacy Officer and updated whenever a provider is added, changed or removed.

10.2 Other disclosures

• With your direction — for example, where you choose to share a certificate, Skill Passport or résumé with an employer or third party.
• To an organization account — where you use SkillShift+ under an employer or organization licence, that organization may access enrolment, progress, completion and certificate information relating to your participation. The scope is disclosed to you at enrolment.
• To professional advisers — legal, accounting and audit advisers under duties of confidentiality.
• To comply with law — in response to a court order, subpoena, warrant, regulatory demand or other lawful requirement, or to establish, exercise or defend legal claims.
• To protect safety and prevent harm — where permitted or required by law, including to prevent or investigate fraud, abuse or a threat to the life, health or security of any person.
• In a business transaction — in connection with a proposed or completed merger, acquisition, financing or sale of assets, in accordance with the requirements of PIPEDA relating to business transactions, including confidentiality and use restrictions.

Our Service Providers may store or process personal information on servers located outside the Province of Ontario and outside Canada, including in the United States and other jurisdictions.

While personal information is located in another jurisdiction, it may be accessible to the courts, law enforcement and national security authorities of that jurisdiction under the laws applicable there, including through lawful access requests, regardless of the protections we have put in place by contract.

We remain accountable for personal information transferred to a Service Provider for processing, and we use contractual and other means to require a comparable level of protection while the information is being processed on our behalf.

• Card payments are processed by Stripe. Card details are submitted to Stripe and are not normally stored on our systems.
• We retain transaction identifiers, amounts, currency, receipts, invoices, subscription status, refund status, credit balances and billing contact information.
• Stripe processes payment information as an independent controller for certain purposes, including fraud prevention and legal compliance, and its own privacy terms apply in addition to this Policy.
• Financial records are retained for seven (7) years, as explained in section 13.

Refund, cancellation, subscription and access rules are set out in the Refund, Cancellation, Subscription and Access Policy.

We retain personal information only as long as necessary to fulfil the purposes for which it was collected, or as required by law. We do not apply a single blanket retention period to all information. The following schedule applies:

The seven-year periods reflect the Canada Revenue Agency requirement that business records generally be kept for six years from the end of the relevant tax year, with a buffer. That financial-records requirement does not justify retaining course, interview, assessment or résumé information for seven years, and we do not do so.

When a retention period expires, information is securely deleted or irreversibly de-identified. Where information is subject to a legal hold, it is retained until the hold is lifted.

Subject to the exceptions permitted by law, you may make the following requests:

Requests should be sent to info@skillsshift.ca, addressed to the Privacy Officer. We may need to verify your identity before acting on a request, and we will use the least intrusive verification method reasonably available.

Under PIPEDA we will respond to an access request within thirty (30) calendar days of receipt, subject to the limited extensions permitted by law. Where an extension applies, we will notify you within the original thirty-day period, explain the reason and tell you when to expect a response. Where we refuse a request in whole or in part, we will explain why and tell you how to complain.

Access may be limited or refused where the information is subject to solicitor-client privilege, would reveal personal information about another individual, would compromise an investigation, or where another statutory exception applies. Where possible, we will sever the exempt material and provide the remainder.

You may ask us to close your Account and delete your information. The process is as follows:

1. Where to request. A self-service deletion control in account Settings is an implementation requirement and will be described here as available only once it functions in production. Until then, deletion may be requested by email to info@skillsshift.ca.
2. Identity verification. We will verify that the request comes from the Account holder.
3. Active subscriptions. Any active subscription must be cancelled or will be cancelled as part of the process. Deletion does not by itself generate a refund; refunds are governed by the Refund Policy.
4. What is deleted. Personal information that we are not legally required to retain is deleted or irreversibly anonymized. This includes profile data, course progress, assessment answers, Career Reports, Skill Passport data, résumé content, interview media and transcripts, and AI inputs and outputs.
5. What is retained. Payment, invoice and tax records, consent and withdrawal records, certificate verification records and records required for legal, security or fraud-prevention purposes are retained for the periods in section 13.
6. Backups. Deleted information may persist in encrypted backups until those backups rotate out, normally within ninety (90) days.
7. Confirmation. We will confirm completion by email.

We protect personal information with safeguards appropriate to its sensitivity, including:

• encryption of information in transit using industry-standard transport encryption;
• password hashing and secure credential handling through our authentication provider;
• role-based access controls and the principle of least privilege;
• restriction of staff and contractor access to those who need it for their duties;
• storage of secrets and API keys in environment variables rather than in source code;
• database backups and tested restore procedures;
• audit logging of administrative actions and Skill Passport point adjustments;
• rate limiting and abuse detection on authentication and API endpoints;
• file-type and file-size restrictions on uploads;
• reliance on the payment-provider safeguards maintained by Stripe for card data; and
• a documented privacy-incident response process.

No method of transmission or storage is completely secure, and we do not represent that the Platform is "100% secure." We work to maintain reasonable safeguards and to improve them over time. You are responsible for keeping your password confidential and for notifying us promptly of any suspected unauthorized use of your Account.

We maintain a documented privacy-incident process covering identification, containment, assessment, notification and remediation. If we suspect a breach of security safeguards, we investigate promptly, take steps to contain it and assess the risk to affected individuals.

PIPEDA requires organizations to keep a record of every breach of security safeguards, whether or not it is reportable. Where a breach creates a real risk of significant harm to an individual, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, and will notify any other organization or government institution that may be able to reduce the risk of harm.

Notification to individuals will describe the circumstances of the breach, when it occurred, the personal information involved, the steps we have taken, the steps you can take to reduce risk, and how to contact us.

18.1 Transactional messages

We send messages necessary to operate your Account and deliver the services you have requested. These are not marketing messages and continue for as long as your Account is active, including:

• account verification and password-reset messages;
• purchase receipts, invoices and subscription notices;
• course, enrolment, certificate and assessment notifications;
• security alerts and important service notices;
• responses to your support enquiries.

18.2 Marketing messages

Marketing messages — promotions, new-course announcements, offers and newsletters — are sent only where you have given separate, express marketing consent. The marketing checkbox is unchecked by default and is not bundled with Terms acceptance or Privacy Policy acknowledgement.

Every marketing message identifies Intellidu Canada Inc. as the sender, provides our mailing address and contact information, and includes a working unsubscribe mechanism. Canada's Anti-Spam Legislation requires unsubscribe requests to be given effect without delay and in any event within ten (10) business days, and we do not require you to take any further step to have your request honoured. Unsubscribing from marketing does not stop transactional messages.

We use cookies and similar technologies for authentication, security, preferences and payments. Strictly necessary cookies are used without consent because the Platform cannot function without them. Optional cookies are used only with your permission, through the cookie banner and preference centre. Analytics and advertising cookies are not currently used. Full details are in the Cookie Policy.

We review this Policy at least annually. We may update it to reflect changes in our services, our Service Providers, or the law. The effective date and last-updated date appear on this document and on the published page.

Where a change is material — for example, a new category of personal information, a new purpose, a new Service Provider that receives personal information, or a change in AI processing — we will provide notice before the change takes effect, through the Platform or by email, and will obtain fresh consent where the law requires it. Continued use of the Platform after a non-material change takes effect indicates acceptance of the updated Policy.

Previous versions of this Policy are retained and are available on request.

If you have a question or concern about our handling of your personal information, please contact the Privacy Officer first. We will acknowledge your complaint, investigate it, and inform you of the outcome and of any corrective action taken.

If you are not satisfied with our response, you may contact: